@things-factory/auth-base 10.1.192 → 10.1.202

package/tests/role-template-gap-db.test.ts

@@ -16,9 +16,11 @@ const { User } = loadCompiled('service/user/user')
 const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
 const { RoleTemplateGapResolver } = loadCompiled('service/role-template/role-template-gap-resolver')
 const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
+const { registerRoleTask } = loadCompiled('service/role-template/role-task')
 
 const mutation = new RoleTemplateMutation()
-const gapOf = (role: any) => new RoleTemplateGapResolver().templateGap(role)
+const gapOf = (role: any, templateId?: string) => new RoleTemplateGapResolver().templateGap(role, templateId)
+const coverageOf = (role: any) => new RoleTemplateGapResolver().taskCoverage(role)
 
 let domain: any
 let actor: any
@@ -71,7 +73,9 @@ describe('the gap between a role and its template', () => {
       templateId: 'plant.qi',
       templateName: 'QUALITY-INSPECTOR',
       missing: [],
-      missingCount: 0
+      missingCount: 0,
+      extra: [],
+      extraCount: 0
     })
   })
 
@@ -120,6 +124,77 @@ describe('the gap between a role and its template', () => {
     ]
     await getRepository(Role).save(stored)
 
+    const gap = await gapOf(role)
+    expect(gap.missingCount).toBe(0)
+    /* Shown as wider than the template - not a fault, and nothing takes it away. */
+    expect(gap.extra).toEqual([{ category: 'board', axes: ['mutation'] }])
+    expect(gap.extraCount).toBe(1)
+  })
+
+  it('★ lays a role against a template the administrator picks, whatever the role is called', async () => {
+    declareTemplate(['query', 'mutation'])
+    const role = await getRepository(Role).save({ domain, name: '품질검사', privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' })] })
+
+    expect(await gapOf(role)).toBeNull()
+    expect(await gapOf(role, 'plant.qi')).toMatchObject({ templateId: 'plant.qi', missing: [{ category: 'board', axes: ['mutation'] }], extraCount: 0 })
+  })
+
+  it('refuses a template id that does not exist rather than answering null', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    await expect(gapOf(role, 'plant.nobody')).rejects.toThrow(/no role template "plant.nobody"/)
+  })
+})
+
+describe('a template built from tasks (ADR-0139 decision 11)', () => {
+  beforeEach(async () => {
+    ;(process as any)['ROLE_TASKS'] = {}
+    ;(process as any)['ROLE_TEMPLATES'] = {}
+    await getRepository(Privilege).save({ name: 'query', category: 'order' })
+    ;(process as any).PRIVILEGES['order query'] = ['order', 'query']
+    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
+    registerRoleTask({ id: 'order.reading', grants: [{ category: 'order', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
+  })
+
+  it('★ holds every privilege of every task once, plus its own grants', async () => {
+    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'order.reading'], grants: [{ category: 'board', axes: ['mutation'] }] })
+    const role = await mutation.createRoleFromTemplate('plant.reader', undefined, context())
+
+    const held = (await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })).privileges.map((p: any) => `${p.category}:${p.name}`).sort()
+    expect(held).toEqual(['board:mutation', 'board:query', 'order:query'])
     expect((await gapOf(role)).missingCount).toBe(0)
   })
+
+  it('★ is refused whole when a task is not registered - no role is made, no privilege added', async () => {
+    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'board.writting'] })
+
+    await expect(mutation.createRoleFromTemplate('plant.reader', undefined, context())).rejects.toThrow(/task "board.writting" is not registered/)
+    expect(await getRepository(Role).findOneBy({ name: 'READER' })).toBeNull()
+  })
+
+  it('★ is refused whole when a task names a privilege this installation does not declare', async () => {
+    registerRoleTask({ id: 'board.exporting', grants: [{ category: 'board-export', axes: ['query'] }] })
+    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'board.exporting'] })
+    const standing = await getRepository(Role).save({ domain, name: 'READER', privileges: [] })
+
+    await expect(mutation.createRoleFromTemplate('plant.reader', undefined, context())).rejects.toThrow(/board-export:query/)
+    expect((await getRepository(Role).findOne({ where: { id: standing.id }, relations: ['privileges'] })).privileges).toEqual([])
+  })
+
+  it('★ the role screen sees a role by task: all, some, none, and what no task names', async () => {
+    const role = await getRepository(Role).save({
+      domain,
+      name: '판독',
+      privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' }), await getRepository(Privilege).findOneBy({ category: 'board', name: 'mutation' })]
+    })
+
+    const coverage = await coverageOf(role)
+    expect(coverage.tasks.map((task: any) => [task.taskId, task.status])).toEqual([
+      ['board.reading', 'all'],
+      ['order.reading', 'some']
+    ])
+    expect(coverage.tasks[1].missing).toEqual([{ category: 'order', axes: ['query'] }])
+    expect(coverage.unclassified).toEqual([{ category: 'board', axes: ['mutation'] }])
+  })
 })

package/translations/en.json

@@ -251,5 +251,18 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "write why you need it.",
   "error.access-request-same-reason-as-denied": "this was denied lately for the same reason ({reason}). write what has changed.",
-  "error.role-belongs-to-parent": "{roles}: a role of the parent domain. only someone who decides roles there can give or take it."
+  "error.role-belongs-to-parent": "{roles}: a role of the parent domain. only someone who decides roles there can give or take it.",
+  "task.auth-base.users-and-roles.name": "Keeping accounts and roles",
+  "task.auth-base.users-and-roles.description": "Reads and changes users, roles and who holds them, invitations, access requests, applications, devices and sign-in providers. Whoever holds this can give any role, to themselves as well.",
+  "task.auth-base.privilege-reading.name": "Reading the privilege list",
+  "task.auth-base.privilege-reading.description": "Reads the privileges roles are made of.",
+  "task.auth-base.security.name": "Keeping security settings",
+  "task.auth-base.security.description": "Reads and changes the domain's protected addresses and sign-in rules.",
+  "task.auth-base.env-vars.name": "Keeping environment variables",
+  "task.auth-base.env-vars.description": "Reads and changes the domain's environment variables.",
+  "privilege.category.audit": "audit log",
+  "privilege.allows.audit.query": "see everyone’s sign-ins, privilege use and refusals, and role changes",
+  "task.auth-base.audit-reading.name": "Reading the audit log",
+  "task.auth-base.audit-reading.description": "Reads everyone's sign-ins, privilege use and refusals, and role changes in the domain.",
+  "error.access-request-task-mismatch": "the work you picked does not include the refused privilege."
 }

package/translations/es.json

@@ -251,5 +251,18 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "indique por qué lo necesita.",
   "error.access-request-same-reason-as-denied": "se rechazó hace poco por el mismo motivo ({reason}). indique qué ha cambiado.",
-  "error.role-belongs-to-parent": "{roles}: un rol del dominio principal. solo quien decide los roles allí puede concederlo o quitarlo."
+  "error.role-belongs-to-parent": "{roles}: un rol del dominio principal. solo quien decide los roles allí puede concederlo o quitarlo.",
+  "task.auth-base.users-and-roles.name": "Mantener cuentas y roles",
+  "task.auth-base.users-and-roles.description": "Lee y modifica usuarios, roles y quién los tiene, invitaciones, solicitudes de acceso, aplicaciones, dispositivos y proveedores de acceso. Quien lo tiene puede dar cualquier rol, también a sí mismo.",
+  "task.auth-base.privilege-reading.name": "Leer la lista de privilegios",
+  "task.auth-base.privilege-reading.description": "Lee los privilegios de los que se componen los roles.",
+  "task.auth-base.security.name": "Mantener la seguridad",
+  "task.auth-base.security.description": "Lee y modifica las direcciones protegidas y las reglas de acceso del dominio.",
+  "task.auth-base.env-vars.name": "Mantener variables de entorno",
+  "task.auth-base.env-vars.description": "Lee y modifica las variables de entorno del dominio.",
+  "privilege.category.audit": "registro de auditoría",
+  "privilege.allows.audit.query": "ver los inicios de sesión, el uso y rechazo de privilegios y los cambios de rol de todos",
+  "task.auth-base.audit-reading.name": "Consultar el registro de auditoría",
+  "task.auth-base.audit-reading.description": "Lee los inicios de sesión, el uso y rechazo de privilegios y los cambios de rol de todos en el dominio.",
+  "error.access-request-task-mismatch": "la tarea elegida no incluye el privilegio rechazado."
 }

package/translations/ja.json

@@ -251,5 +251,18 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "必要な理由を書いてください。",
   "error.access-request-same-reason-as-denied": "同じ理由で最近拒否されました({reason})。何が変わったかを書いてください。",
-  "error.role-belongs-to-parent": "{roles}: 上位$t(term.domain)のロールです。その$t(term.domain)で権限を決める人だけが付与・解除できます。"
+  "error.role-belongs-to-parent": "{roles}: 上位$t(term.domain)のロールです。その$t(term.domain)で権限を決める人だけが付与・解除できます。",
+  "task.auth-base.users-and-roles.name": "アカウント・ロールの管理",
+  "task.auth-base.users-and-roles.description": "ユーザー・ロールとその付与・招待・アクセス申請・アプリ・機器・ログイン提供者を読み、変更する。自分にもどのロールでも付与できる。",
+  "task.auth-base.privilege-reading.name": "権限一覧の閲覧",
+  "task.auth-base.privilege-reading.description": "ロールを構成する権限の一覧を読む。",
+  "task.auth-base.security.name": "セキュリティ設定",
+  "task.auth-base.security.description": "ドメインの保護アドレスとログイン規則を読み、変更する。",
+  "task.auth-base.env-vars.name": "環境変数",
+  "task.auth-base.env-vars.description": "ドメインの環境変数を読み、変更する。",
+  "privilege.category.audit": "監査ログ",
+  "privilege.allows.audit.query": "全ユーザーのログイン、権限の使用と拒否、ロール変更の記録を見ることができます。",
+  "task.auth-base.audit-reading.name": "監査ログの閲覧",
+  "task.auth-base.audit-reading.description": "全ユーザーのログイン、権限の使用と拒否、ロール変更の記録を読む。",
+  "error.access-request-task-mismatch": "選んだ業務に拒否された権限が含まれていません。"
 }

package/translations/ko.json

@@ -251,5 +251,18 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "필요한 사유를 입력해 주세요.",
   "error.access-request-same-reason-as-denied": "동일한 사유로 최근에 거부된 요청입니다({reason}). 다시 요청하려면 변경된 사항을 입력해 주세요.",
-  "error.role-belongs-to-parent": "{roles}: 상위 $t(term.domain)의 역할입니다. 그 $t(term.domain)에서 권한을 정하는 사람만 주거나 뺄 수 있습니다."
+  "error.role-belongs-to-parent": "{roles}: 상위 $t(term.domain)의 역할입니다. 그 $t(term.domain)에서 권한을 정하는 사람만 주거나 뺄 수 있습니다.",
+  "task.auth-base.users-and-roles.name": "계정·역할 관리",
+  "task.auth-base.users-and-roles.description": "사용자·역할과 역할 부여·초대·접근 요청·앱·기기·로그인 제공자를 읽고 바꾼다. 자기에게도 어떤 역할이든 줄 수 있다.",
+  "task.auth-base.privilege-reading.name": "권한 목록 열람",
+  "task.auth-base.privilege-reading.description": "역할을 이루는 권한 목록을 읽는다.",
+  "task.auth-base.security.name": "보안 설정",
+  "task.auth-base.security.description": "도메인의 보호 주소와 로그인 규칙을 읽고 바꾼다.",
+  "task.auth-base.env-vars.name": "환경 변수",
+  "task.auth-base.env-vars.description": "도메인의 환경 변수를 읽고 바꾼다.",
+  "privilege.category.audit": "감사 기록",
+  "privilege.allows.audit.query": "모든 사용자의 로그인, 권한 사용과 거절, 역할 변경 기록을 볼 수 있습니다.",
+  "task.auth-base.audit-reading.name": "감사 기록 열람",
+  "task.auth-base.audit-reading.description": "모든 사용자의 로그인, 권한 사용과 거절, 역할 변경 기록을 읽는다.",
+  "error.access-request-task-mismatch": "고른 업무에 거절된 권한이 들어 있지 않습니다."
 }

package/translations/ms.json

@@ -251,5 +251,18 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "tulis sebab anda memerlukannya.",
   "error.access-request-same-reason-as-denied": "ini ditolak baru-baru ini atas sebab yang sama ({reason}). tulis apa yang telah berubah.",
-  "error.role-belongs-to-parent": "{roles}: peranan $t(term.domain) induk. hanya mereka yang memutuskan peranan di sana boleh memberi atau menariknya."
+  "error.role-belongs-to-parent": "{roles}: peranan $t(term.domain) induk. hanya mereka yang memutuskan peranan di sana boleh memberi atau menariknya.",
+  "task.auth-base.users-and-roles.name": "Menyelenggara akaun dan peranan",
+  "task.auth-base.users-and-roles.description": "Membaca dan mengubah pengguna, peranan dan pemegangnya, jemputan, permintaan akses, aplikasi, peranti dan penyedia log masuk. Pemegangnya boleh memberi apa-apa peranan, termasuk kepada diri sendiri.",
+  "task.auth-base.privilege-reading.name": "Membaca senarai keistimewaan",
+  "task.auth-base.privilege-reading.description": "Membaca keistimewaan yang membentuk peranan.",
+  "task.auth-base.security.name": "Menyelenggara tetapan keselamatan",
+  "task.auth-base.security.description": "Membaca dan mengubah alamat dilindungi dan peraturan log masuk domain.",
+  "task.auth-base.env-vars.name": "Menyelenggara pemboleh ubah persekitaran",
+  "task.auth-base.env-vars.description": "Membaca dan mengubah pemboleh ubah persekitaran domain.",
+  "privilege.category.audit": "log audit",
+  "privilege.allows.audit.query": "boleh melihat log masuk, penggunaan dan penolakan keistimewaan, serta perubahan peranan semua orang.",
+  "task.auth-base.audit-reading.name": "Membaca log audit",
+  "task.auth-base.audit-reading.description": "Membaca log masuk, penggunaan dan penolakan keistimewaan, serta perubahan peranan semua orang dalam domain.",
+  "error.access-request-task-mismatch": "tugas yang dipilih tidak termasuk keistimewaan yang ditolak."
 }

package/translations/zh.json

@@ -251,5 +251,18 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "请填写需要的理由。",
   "error.access-request-same-reason-as-denied": "最近以相同理由被拒绝({reason})。请写明有何变化。",
-  "error.role-belongs-to-parent": "{roles}: 上级$t(term.domain)的角色。只有在该$t(term.domain)负责权限的人才能授予或移除。"
+  "error.role-belongs-to-parent": "{roles}: 上级$t(term.domain)的角色。只有在该$t(term.domain)负责权限的人才能授予或移除。",
+  "task.auth-base.users-and-roles.name": "管理账户与角色",
+  "task.auth-base.users-and-roles.description": "读取并修改用户、角色及其授予、邀请、访问申请、应用、设备和登录提供方。持有者可以给任何人（包括自己）任何角色。",
+  "task.auth-base.privilege-reading.name": "查看权限列表",
+  "task.auth-base.privilege-reading.description": "读取构成角色的权限列表。",
+  "task.auth-base.security.name": "安全设置",
+  "task.auth-base.security.description": "读取并修改域的受保护地址和登录规则。",
+  "task.auth-base.env-vars.name": "环境变量",
+  "task.auth-base.env-vars.description": "读取并修改域的环境变量。",
+  "privilege.category.audit": "审计日志",
+  "privilege.allows.audit.query": "可以查看所有用户的登录、权限使用与拒绝以及角色变更记录。",
+  "task.auth-base.audit-reading.name": "查看审计日志",
+  "task.auth-base.audit-reading.description": "读取所有用户的登录、权限使用与拒绝以及角色变更记录。",
+  "error.access-request-task-mismatch": "所选业务不包含被拒绝的权限。"
 }

package/dist-server/service/login-history/index.d.ts

@@ -1,4 +0,0 @@
-import { LoginHistory } from './login-history.js';
-import { LoginHistoryQuery } from './login-history-query.js';
-export declare const entities: (typeof LoginHistory)[];
-export declare const resolvers: (typeof LoginHistoryQuery)[];

package/dist-server/service/login-history/index.js

@@ -1,8 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolvers = exports.entities = void 0;
-const login_history_js_1 = require("./login-history.js");
-const login_history_query_js_1 = require("./login-history-query.js");
-exports.entities = [login_history_js_1.LoginHistory];
-exports.resolvers = [login_history_query_js_1.LoginHistoryQuery];
-//# sourceMappingURL=index.js.map

package/dist-server/service/login-history/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/login-history/index.ts"],"names":[],"mappings":";;;AAAA,yDAAiD;AACjD,qEAA4D;AAE/C,QAAA,QAAQ,GAAG,CAAC,+BAAY,CAAC,CAAA;AACzB,QAAA,SAAS,GAAG,CAAC,0CAAiB,CAAC,CAAA","sourcesContent":["import { LoginHistory } from './login-history.js'\nimport { LoginHistoryQuery } from './login-history-query.js'\n\nexport const entities = [LoginHistory]\nexport const resolvers = [LoginHistoryQuery]\n"]}

package/dist-server/service/login-history/login-history-query.d.ts

@@ -1,10 +0,0 @@
-import { Domain, ListParam } from '@things-factory/shell';
-import { User } from '../user/user.js';
-import { LoginHistory } from './login-history.js';
-import { LoginHistoryList } from './login-history-type.js';
-export declare class LoginHistoryQuery {
-    loginHistories(params: ListParam, context: ResolverContext): Promise<LoginHistoryList>;
-    myLoginHistories(limit: number, context: ResolverContext): Promise<LoginHistory[]>;
-    accessDomain(loginHistory: LoginHistory): Promise<Domain>;
-    accessUser(loginHistory: LoginHistory): Promise<User>;
-}

package/dist-server/service/login-history/login-history-query.js

@@ -1,80 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoginHistoryQuery = void 0;
-const tslib_1 = require("tslib");
-const type_graphql_1 = require("type-graphql");
-const shell_1 = require("@things-factory/shell");
-const user_js_1 = require("../user/user.js");
-const login_history_js_1 = require("./login-history.js");
-const login_history_type_js_1 = require("./login-history-type.js");
-let LoginHistoryQuery = class LoginHistoryQuery {
-    /* Everybody's sign-ins. `myLoginHistories` below is the one that answers about the caller,
-       and it exists precisely because this one should not be open. */
-    async loginHistories(params, context) {
-        const { domain } = context.state;
-        /*
-         * The row's domain is `accessDomain` - there is no `domain` column, so handing `domain` to the builder failed every
-         * call (no such column). This domain's sign-ins only; `inherited` never widens it to the parent's.
-         */
-        const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
-            params: { ...params, inherited: shell_1.InheritedValueType.None },
-            repository: (0, shell_1.getRepository)(login_history_js_1.LoginHistory),
-            alias: 'loginHistory'
-        }).andWhere('loginHistory.accessDomain = :accessDomainId', { accessDomainId: domain.id });
-        const [items, total] = await queryBuilder.getManyAndCount();
-        return { items, total };
-    }
-    async myLoginHistories(limit, context) {
-        const user = context.state.user;
-        if (!user) {
-            throw new Error('No user specified');
-        }
-        return await (0, shell_1.getRepository)(login_history_js_1.LoginHistory).find({
-            where: { accessUser: { id: user.id } },
-            take: limit || 10,
-            order: { accessedAt: 'DESC' }
-        });
-    }
-    async accessDomain(loginHistory) {
-        return await (0, shell_1.getRepository)(shell_1.Domain).findOneBy({ id: loginHistory.accessDomainId });
-    }
-    async accessUser(loginHistory) {
-        return await (0, shell_1.getRepository)(user_js_1.User).findOneBy({ id: loginHistory.accessUserId });
-    }
-};
-exports.LoginHistoryQuery = LoginHistoryQuery;
-tslib_1.__decorate([
-    (0, type_graphql_1.Directive)('@privilege(category: "user", privilege: "query", domainOwnerGranted: true, superUserGranted: true)'),
-    (0, type_graphql_1.Query)(returns => login_history_type_js_1.LoginHistoryList, { description: 'To fetch multiple LoginHistories' }),
-    tslib_1.__param(0, (0, type_graphql_1.Args)(type => shell_1.ListParam)),
-    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [shell_1.ListParam, Object]),
-    tslib_1.__metadata("design:returntype", Promise)
-], LoginHistoryQuery.prototype, "loginHistories", null);
-tslib_1.__decorate([
-    (0, type_graphql_1.Query)(returns => [login_history_js_1.LoginHistory]),
-    tslib_1.__param(0, (0, type_graphql_1.Arg)('limit')),
-    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [Number, Object]),
-    tslib_1.__metadata("design:returntype", Promise)
-], LoginHistoryQuery.prototype, "myLoginHistories", null);
-tslib_1.__decorate([
-    (0, type_graphql_1.FieldResolver)(),
-    tslib_1.__param(0, (0, type_graphql_1.Root)()),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [login_history_js_1.LoginHistory]),
-    tslib_1.__metadata("design:returntype", Promise)
-], LoginHistoryQuery.prototype, "accessDomain", null);
-tslib_1.__decorate([
-    (0, type_graphql_1.FieldResolver)(),
-    tslib_1.__param(0, (0, type_graphql_1.Root)()),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [login_history_js_1.LoginHistory]),
-    tslib_1.__metadata("design:returntype", Promise)
-], LoginHistoryQuery.prototype, "accessUser", null);
-exports.LoginHistoryQuery = LoginHistoryQuery = tslib_1.__decorate([
-    (0, type_graphql_1.Resolver)(login_history_js_1.LoginHistory)
-], LoginHistoryQuery);
-//# sourceMappingURL=login-history-query.js.map

package/dist-server/service/login-history/login-history-query.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"login-history-query.js","sourceRoot":"","sources":["../../../server/service/login-history/login-history-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,iDAA2H;AAE3H,6CAAsC;AACtC,yDAAiD;AACjD,mEAA0D;AAGnD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B;sEACkE;IAG5D,AAAN,KAAK,CAAC,cAAc,CACO,MAAiB,EACnC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC;;;WAGG;QACH,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,+BAAY,CAAC;YACvC,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;QAEzF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAAe,KAAa,EAAS,OAAwB;QACjF,MAAM,IAAI,GAAS,OAAO,CAAC,KAAK,CAAC,IAAI,CAAA;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACtC,CAAC;QAED,OAAO,MAAM,IAAA,qBAAa,EAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;YAC5C,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;YACtC,IAAI,EAAE,KAAK,IAAI,EAAE;YACjB,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;SAC9B,CAAC,CAAA;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CAAS,YAA0B;QACnD,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC,CAAA;IACnF,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAS,YAA0B;QACjD,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,CAAA;IAC/E,CAAC;CACF,CAAA;AAhDY,8CAAiB;AAKtB;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wCAAgB,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAErF,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IACvB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,iBAAS;;uDAiB3C;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,+BAAY,CAAC,CAAC;IACT,mBAAA,IAAA,kBAAG,EAAC,OAAO,CAAC,CAAA;IAAiB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;yDAWzD;AAGK;IADL,IAAA,4BAAa,GAAE;IACI,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAe,+BAAY;;qDAEpD;AAGK;IADL,IAAA,4BAAa,GAAE;IACE,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAe,+BAAY;;mDAElD;4BA/CU,iBAAiB;IAD7B,IAAA,uBAAQ,EAAC,+BAAY,CAAC;GACV,iBAAiB,CAgD7B","sourcesContent":["import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\n\nimport { Domain, getQueryBuilderFromListParams, InheritedValueType, getRepository, ListParam } from '@things-factory/shell'\n\nimport { User } from '../user/user.js'\nimport { LoginHistory } from './login-history.js'\nimport { LoginHistoryList } from './login-history-type.js'\n\n@Resolver(LoginHistory)\nexport class LoginHistoryQuery {\n  /* Everybody's sign-ins. `myLoginHistories` below is the one that answers about the caller,\n     and it exists precisely because this one should not be open. */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => LoginHistoryList, { description: 'To fetch multiple LoginHistories' })\n  async loginHistories(\n    @Args(type => ListParam) params: ListParam,\n    @Ctx() context: ResolverContext\n  ): Promise<LoginHistoryList> {\n    const { domain } = context.state\n\n    /*\n     * The row's domain is `accessDomain` - there is no `domain` column, so handing `domain` to the builder failed every\n     * call (no such column). This domain's sign-ins only; `inherited` never widens it to the parent's.\n     */\n    const queryBuilder = getQueryBuilderFromListParams({\n      params: { ...params, inherited: InheritedValueType.None },\n      repository: getRepository(LoginHistory),\n      alias: 'loginHistory'\n    }).andWhere('loginHistory.accessDomain = :accessDomainId', { accessDomainId: domain.id })\n\n    const [items, total] = await queryBuilder.getManyAndCount()\n    return { items, total }\n  }\n\n  @Query(returns => [LoginHistory])\n  async myLoginHistories(@Arg('limit') limit: number, @Ctx() context: ResolverContext): Promise<LoginHistory[]> {\n    const user: User = context.state.user\n    if (!user) {\n      throw new Error('No user specified')\n    }\n\n    return await getRepository(LoginHistory).find({\n      where: { accessUser: { id: user.id } },\n      take: limit || 10,\n      order: { accessedAt: 'DESC' }\n    })\n  }\n\n  @FieldResolver()\n  async accessDomain(@Root() loginHistory: LoginHistory) {\n    return await getRepository(Domain).findOneBy({ id: loginHistory.accessDomainId })\n  }\n\n  @FieldResolver()\n  async accessUser(@Root() loginHistory: LoginHistory) {\n    return await getRepository(User).findOneBy({ id: loginHistory.accessUserId })\n  }\n}\n"]}

package/dist-server/service/login-history/login-history-type.d.ts

@@ -1,5 +0,0 @@
-import { LoginHistory } from './login-history.js';
-export declare class LoginHistoryList {
-    items: LoginHistory[];
-    total: number;
-}

package/dist-server/service/login-history/login-history-type.js

@@ -1,21 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoginHistoryList = void 0;
-const tslib_1 = require("tslib");
-const type_graphql_1 = require("type-graphql");
-const login_history_js_1 = require("./login-history.js");
-let LoginHistoryList = class LoginHistoryList {
-};
-exports.LoginHistoryList = LoginHistoryList;
-tslib_1.__decorate([
-    (0, type_graphql_1.Field)(type => [login_history_js_1.LoginHistory], { description: 'The list of login history items.' }),
-    tslib_1.__metadata("design:type", Array)
-], LoginHistoryList.prototype, "items", void 0);
-tslib_1.__decorate([
-    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'The total number of login history records.' }),
-    tslib_1.__metadata("design:type", Number)
-], LoginHistoryList.prototype, "total", void 0);
-exports.LoginHistoryList = LoginHistoryList = tslib_1.__decorate([
-    (0, type_graphql_1.ObjectType)({ description: 'A paginated list of login history records.' })
-], LoginHistoryList);
-//# sourceMappingURL=login-history-type.js.map

package/dist-server/service/login-history/login-history-type.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"login-history-type.js","sourceRoot":"","sources":["../../../server/service/login-history/login-history-type.ts"],"names":[],"mappings":";;;;AAAA,+CAAoE;AAEpE,yDAAiD;AAG1C,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAM5B,CAAA;AANY,4CAAgB;AAE3B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,+BAAY,CAAC,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;;+CAC9D;AAGrB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;+CACrE;2BALF,gBAAgB;IAD5B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;GAC7D,gBAAgB,CAM5B","sourcesContent":["import { Field, ID, InputType, Int, ObjectType } from 'type-graphql'\n\nimport { LoginHistory } from './login-history.js'\n\n@ObjectType({ description: 'A paginated list of login history records.' })\nexport class LoginHistoryList {\n  @Field(type => [LoginHistory], { description: 'The list of login history items.' })\n  items: LoginHistory[]\n\n  @Field(type => Int, { description: 'The total number of login history records.' })\n  total: number\n}\n"]}

package/dist-server/service/login-history/login-history.d.ts

@@ -1,12 +0,0 @@
-import { Domain } from '@things-factory/shell';
-import { User } from '../user/user.js';
-export declare class LoginHistory {
-    readonly id: string;
-    accessDomain?: Domain;
-    accessDomainId: string;
-    accessUser: User;
-    accessUserId: string;
-    accessorIp: string;
-    accessedAt: Date;
-    static stamp(accessDomain: Partial<Domain>, accessUser: User, accessorIp: string): Promise<void>;
-}

package/dist-server/service/login-history/login-history.js

@@ -1,58 +0,0 @@
-"use strict";
-var LoginHistory_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoginHistory = void 0;
-const tslib_1 = require("tslib");
-const type_graphql_1 = require("type-graphql");
-const typeorm_1 = require("typeorm");
-const shell_1 = require("@things-factory/shell");
-const user_js_1 = require("../user/user.js");
-let LoginHistory = LoginHistory_1 = class LoginHistory {
-    static async stamp(accessDomain, accessUser, accessorIp) {
-        await (0, shell_1.getRepository)(LoginHistory_1).save({
-            accessDomain,
-            accessUser,
-            accessorIp
-        });
-    }
-};
-exports.LoginHistory = LoginHistory;
-tslib_1.__decorate([
-    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
-    (0, type_graphql_1.Field)(type => type_graphql_1.ID, { description: 'Unique identifier for the login history record.' }),
-    tslib_1.__metadata("design:type", String)
-], LoginHistory.prototype, "id", void 0);
-tslib_1.__decorate([
-    (0, typeorm_1.ManyToOne)(type => shell_1.Domain),
-    (0, type_graphql_1.Field)(type => shell_1.Domain, { description: 'The domain the user logged into.' }),
-    tslib_1.__metadata("design:type", shell_1.Domain)
-], LoginHistory.prototype, "accessDomain", void 0);
-tslib_1.__decorate([
-    (0, typeorm_1.RelationId)((loginHistory) => loginHistory.accessDomain),
-    tslib_1.__metadata("design:type", String)
-], LoginHistory.prototype, "accessDomainId", void 0);
-tslib_1.__decorate([
-    (0, typeorm_1.ManyToOne)(type => user_js_1.User),
-    (0, type_graphql_1.Field)(type => user_js_1.User, { description: 'The user who logged in.' }),
-    tslib_1.__metadata("design:type", user_js_1.User)
-], LoginHistory.prototype, "accessUser", void 0);
-tslib_1.__decorate([
-    (0, typeorm_1.RelationId)((loginHistory) => loginHistory.accessUser),
-    tslib_1.__metadata("design:type", String)
-], LoginHistory.prototype, "accessUserId", void 0);
-tslib_1.__decorate([
-    (0, typeorm_1.Column)({ nullable: true }),
-    (0, type_graphql_1.Field)({ nullable: true, description: 'The IP address from which the login attempt was made.' }),
-    tslib_1.__metadata("design:type", String)
-], LoginHistory.prototype, "accessorIp", void 0);
-tslib_1.__decorate([
-    (0, typeorm_1.CreateDateColumn)(),
-    (0, type_graphql_1.Field)({ nullable: true, description: 'The timestamp of the login attempt.' }),
-    tslib_1.__metadata("design:type", Date)
-], LoginHistory.prototype, "accessedAt", void 0);
-exports.LoginHistory = LoginHistory = LoginHistory_1 = tslib_1.__decorate([
-    (0, typeorm_1.Entity)(),
-    (0, typeorm_1.Index)('ix_login_history_0', (loginHistory) => [loginHistory.accessDomain, loginHistory.accessUser]),
-    (0, type_graphql_1.ObjectType)({ description: 'Records user login attempts.' })
-], LoginHistory);
-//# sourceMappingURL=login-history.js.map

package/dist-server/service/login-history/login-history.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"login-history.js","sourceRoot":"","sources":["../../../server/service/login-history/login-history.ts"],"names":[],"mappings":";;;;;AAAA,+CAAoD;AACpD,qCAAgH;AAEhH,iDAA6D;AAE7D,6CAAsC;AAK/B,IAAM,YAAY,oBAAlB,MAAM,YAAY;IA2BvB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAA6B,EAAE,UAAgB,EAAE,UAAkB;QACpF,MAAM,IAAA,qBAAa,EAAC,cAAY,CAAC,CAAC,IAAI,CAAC;YACrC,YAAY;YACZ,UAAU;YACV,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;CACF,CAAA;AAlCY,oCAAY;AAGd;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;;wCACnE;AAInB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IACzB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;sCAC5D,cAAM;kDAAA;AAGrB;IADC,IAAA,oBAAU,EAAC,CAAC,YAA0B,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC;;oDAChD;AAItB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACvB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;sCACpD,cAAI;gDAAA;AAGhB;IADC,IAAA,oBAAU,EAAC,CAAC,YAA0B,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;;kDAChD;AAIpB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;;gDAC9E;AAIlB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;sCAClE,IAAI;gDAAA;uBAzBL,YAAY;IAHxB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,oBAAoB,EAAE,CAAC,YAA0B,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IACjH,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;GAC/C,YAAY,CAkCxB","sourcesContent":["import { Field, ID, ObjectType } from 'type-graphql'\nimport { Column, CreateDateColumn, Entity, Index, ManyToOne, PrimaryGeneratedColumn, RelationId } from 'typeorm'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { User } from '../user/user.js'\n\n@Entity()\n@Index('ix_login_history_0', (loginHistory: LoginHistory) => [loginHistory.accessDomain, loginHistory.accessUser])\n@ObjectType({ description: 'Records user login attempts.' })\nexport class LoginHistory {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for the login history record.' })\n  readonly id: string\n\n  @ManyToOne(type => Domain)\n  @Field(type => Domain, { description: 'The domain the user logged into.' })\n  accessDomain?: Domain\n\n  @RelationId((loginHistory: LoginHistory) => loginHistory.accessDomain)\n  accessDomainId: string\n\n  @ManyToOne(type => User)\n  @Field(type => User, { description: 'The user who logged in.' })\n  accessUser: User\n\n  @RelationId((loginHistory: LoginHistory) => loginHistory.accessUser)\n  accessUserId: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'The IP address from which the login attempt was made.' })\n  accessorIp: string\n\n  @CreateDateColumn()\n  @Field({ nullable: true, description: 'The timestamp of the login attempt.' })\n  accessedAt: Date\n\n  static async stamp(accessDomain: Partial<Domain>, accessUser: User, accessorIp: string): Promise<void> {\n    await getRepository(LoginHistory).save({\n      accessDomain,\n      accessUser,\n      accessorIp\n    })\n  }\n}\n"]}